CancelDll
LoadDll
Behavioral task
behavioral1
Sample
b72c03ba4dd7677595f245b0b5737402_JaffaCakes118.dll
Resource
win7-20240708-en
Target
b72c03ba4dd7677595f245b0b5737402_JaffaCakes118
Size
79KB
MD5
b72c03ba4dd7677595f245b0b5737402
SHA1
11b21350cb3375ac10470dcb10336b7c3f1d1741
SHA256
7e16ec8f812a85e5128e7e7da27ae758ef693a575d4edce524bc1075f1b4b043
SHA512
756c86f6bc72aa51c2b34e2e7b9477bea8dec3491d0f05c9cda11f3f1fa10088d5e40a1cb5fbdb2e744c801d903bcf92d22a97403de18814000959a795c2e2d4
SSDEEP
1536:6hoJnwF/jFbM6iHUXQtVYuhVKyblopBY7Hdcbe+Y5Pvn6/wxi0GOo5xgBCt:6CwF/hbp+4QrGybye6bPYJn6/Soft
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
b72c03ba4dd7677595f245b0b5737402_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ